Azure Private Endpoints (Private Link) with services like App Services, SQL, and Storage Accounts

[@snmailist1470]

Well explanation video, thx for that. 7:40, Why didn't you expose your "firewall and virtual networks" setting ? I want to know about 'Deny public network access' if it was enabled. 3:18, And, you have VPN Gateway connection, it means you have been already connected into VPN before you login your SSMS in your local machine ?

[@Atmosera-]

I don't recall. I did this for a demo, so I can't remember exactly what settings we had.

[@chennareddy2770]

Hi Team, Awesome video. Can you give me the example of cname record which you are talking about webapp where i want to use in prod scenario.

[@michaelharris9746]

This was a huge help, thanks!

[@lindakh3888]

This was really helpful, thank you

[@tarcisio825]

Hi, thanks for the video. I am wondering if it's possible to set it up for a VPN that my client has that is totally independent from Microsoft. I have the DNS, is there anyway I can use it? I am doing this for limiting the access to Power BI

[@Atmosera-]

Depends on the VPN. You can use virtual appliances on Azure as endpoints, and Azure integrates with many common protocols, like IPSEC.

[@testingtestingjjj2544]

When you create VPN gateway it creates a separate vnet, now the db is one vnet and the vpn is on another how do you connect the vpn subnet to the dbsubnet so you connect from home to azure vpn then to the dbsubnet?

[@Atmosera-]

Use VNet peering between the Vnet's to connect them together.

[@poat5404]

I was doing everything else in this video first - was getting 403 - Forbidden from Azure (blue page). Added the DNS stuff which I had missed which routes to the VNet address - now I can't connect at all on VPN or anywhere - just "times out" in the browser :(

[@Atmosera-]

Locally? If you can't connect to Azure, the DNS record might be messed up. Not sure what to tell you though....

[@poat5404]

@@Atmosera- yeah seems to be it. It works if I have "Default (Azure-provided)" in my DNS section for the VNet, however I do have custom DNS. I even manually added Azure's DNS IP and then it doesn't work anymore :shrugs: - i'll keep digging

[@thomaslaw9388]

Really informative video. I'm new to web services. Can you share some more information on how to setup the DNS for web app so that it can work without changing the host file? Thanks in advance.

[@Atmosera-]

You would need a private DNS setup. That's pretty straight forward. docs.microsoft.com/en-us/azure/dns/private-dns-privatednszone

[@eddielopez5935]

Awesome video! Any idea if there's a way to use Azure Services, such as an automation account, to run runbooks against SQL databases using the private endpoint? I'm getting denied because running the runbook appears to be coming from a public address

[@Atmosera-]

Not that I know of. Runbooks would have to run in a context that could hut the private endpoint, and I don't know that they do.

[@eddielopez5935]

@@Atmosera- Thanks for the response, yea, I'm still hammering away at it. One would think that if private links for both the Azure SQL DBs and Automation account, there would be communication through the vnet to which they are associated...

[@Brombrom41]

Is it possible to access Azure storage account which has private link setup through the Azure Storage Explorer in my computer ?

[@Atmosera-]

It is, but you need to figure out the DNS and make sure the routing works too.

[@youssefchtourou1841]

It's possible to access to keyvault secret from Azure Web App (linux) througth private endpoint ?

[@Atmosera-]

Should be if your App Service is on a private endpoint as well.

[@Power_in_Praise]

Hi, I created 3 Azure web apps in the same network and 1 app is public-facing and the other 2 apps should have access through the 1st app. I used the "access restriction" and turned off public access to the other 2 apps. How can we access the other 2 apps from 1st app.? Please help.

[@Atmosera-]

You'd need to upgrade the app services to at least a Premium V2 to expose the backends as a private endpoint, then turn on VNet integration for the frontend services to allow them to reach the private back end.

[@Power_in_Praise]

@@Atmosera- Can you please make a video on this as well..?

[@Atmosera-]

@@Power_in_Praise It's pretty much the same as setting up VNet integration on the networking tab. Check the settings there for that.

[@jagkoth]

Beautiful

[@keyvan.k]

awesome